Halliburton RansomHub ransomware

On August 21, 2024, Halliburton Company, the world's second-largest oilfield-services firm, detected unauthorized access on its corporate IT systems and elected a precautionary shutdown of certain applications, including production-planning and shipment-tracking systems used in customer-service delivery. The company filed Form 8-K with the SEC on August 23, 2024, and a subsequent 8-K/A confirming data exfiltration. The RansomHub ransomware-as-a-service operation listed Halliburton on its public leak site within days, claiming credit. Halliburton's third-quarter 2024 financial results, filed in late October, quantified the direct pretax cost of the incident at approximately $35 million, with an adjusted-EPS impact of approximately $0.02 per share for the quarter, attributed to lost or delayed revenue from system unavailability. The company has not disclosed whether a ransom was paid or whether negotiations took place. Halliburton has stated that downhole well-control and rig-side operational technology was not impacted by the incident; the disruption was at the corporate-systems and customer-service-delivery layer.

$35 million in direct pretax charges; $0.02 per-share Q3 adjusted-EPS impact; service-delivery disruption to oilfield clients including shipment tracking and production planning; sector-wide reinforcement of SEC Item 1.05 disclosure norms in oil-and-gas services.